- Security-news - lists.drupal.org

SA-CONTRIB-2012-073 - Glossary - Cross-Site Scripting (XSS)
by security-news＠drupal.org 09 May '12

09 May '12

View online: http://drupal.org/node/1569482 * Advisory ID: DRUPAL-SA-CONTRIB-2012-073 * Project: Glossary [1] (third-party module) * Version: 6.x * Date: 2012-May-09 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The glossary module scans posts for glossary terms, adding an indicator. By hovering over the indicator, users may learn the definition of that term. The module does not sufficiently sanitize the taxonomy information. This leaves sites vulnerable to Cross-Site Scripting attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permissions to create or edit taxonomy terms. -------- VERSIONS AFFECTED --------------------------------------------------- * Glossary 6.x-1.x versions prior to 6.x-1.8. Drupal core is not affected. If you do not use the contributed Glossary [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Glossary module for Drupal 6.x, upgrade to Glossary 6.x-1.8 [4]. Also see the Glossary [5] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Wilder-Tack [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Nancy Wichmann [7] the module maintainer * Chris Hales [8] -------- COORDINATED BY ------------------------------------------------------ * Forest Monsen [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/glossary [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/glossary [4] http://drupal.org/node/1568156 [5] http://drupal.org/project/glossary [6] http://drupal.org/user/96647 [7] http://drupal.org/user/101412 [8] http://drupal.org/user/347249 [9] http://drupal.org/user/181798 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CORE-2012-002 - Drupal core multiple vulnerabilities
by security-news＠drupal.org 03 May '12

03 May '12

View online: http://drupal.org/node/1557938 * Advisory ID: DRUPAL-SA-CORE-2012-002 * Project: Drupal core [1] * Version: 7.x * Date: 2012-May-2 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Denial of Service, Access bypass -------- DESCRIPTION --------------------------------------------------------- .... Denial of Service CVE: CVE-2012-1588 Drupal core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal's text matching was found to be inefficient with certain specially crafted strings. This vulnerability is mitigated by the fact that users must have the ability to post content sent to the filter system such as a role with the "post comments" or "Forum topic: Create new content" permission. .... Unvalidated form redirect CVE: CVE-2012-1589 Drupal core's Form API allows users to set a destination, but failed to validate that the URL was internal to the site. This weakness could be abused to redirect the login from to a remote site with a malicious script that harvests the login credentials and redirects to the live site. This vulnerability is mitigated only by the end user's ability to recognize a URL with malicious query parameters to avoid the social engineering required to exploit the problem. .... Access bypass - forum listing CVE: CVE-2012-1590 Drupal core's forum lists fail to check user access to nodes when displaying them in the forum overview page. If an unpublished node was the most recently updated in a forum then users who should not have access to unpublished forum posts were still be able to see meta-data about the forum post such as the post title. .... Access bypass - private images CVE: CVE-2012-1591 Drupal core provides the ability to have private files, including images, and Image Styles which create derivative images from an original image that may differ, for example, in size or saturation. Drupal core failed to properly terminate the page request for cached image styles allowing users to access image derivatives for images they should not be able to view. Furthermore, Drupal didn't set the right headers to prevent image styles from being cached in the browser. .... Access bypass - content administration CVE: Requested. Drupal core provides the ability to list nodes on a site at admin/content. Drupal core failed to confirm a user viewing that page had access to each node in the list. This vulnerability only concerns sites running a contributed node access module and is mitigated by the fact that users must have a role with the "view content overview" permission. Unpublished nodes were not displayed to users who only had the "view content overview" permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal core 7.x versions prior to 7.13. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal 7.x, upgrade to Drupal core 7.13 [3] Also see the Drupal core [4] project page. -------- REPORTED BY --------------------------------------------------------- * The Denial of Service vulnerability was reported by Jay Wineinger [5] and Lin Clark [6]. * The unvalidated form redirect vulnerability was reported by Károly Négyesi [7] of the Drupal Security Team. * The access bypass in forum listing vulnerability was reported by Glen W [8]. * The access bypass for private images vulnerability was reported by frega [9], Andreas Gonell [10], Jeremy Meier [11] and Xenza [12]. * The access bypass for the content administration vulnerability was reported by Jennifer Hodgdon [13]. -------- FIXED BY ------------------------------------------------------------ * The Denial of Service was fixed by Károly Négyesi [14] of the Drupal Security Team. * The unvalidated form redirect was fixed by Wolfgang Ziegler [15] and Stéphane Corlosquet [16] of the Drupal Security Team. * The access bypass in forum listing was fixed by Michael Hess [17] of the Drupal Security Team, Ben Jeavons [18] of the Drupal Security Team and xjm [19]. * The Access bypass for private images was fixed by Károly Négyesi [20] of the Drupal Security Team, Damien Tournoud [21] of the Drupal Security Team, Greg Knaddison [22] of the Drupal Security Team, Stéphane Corlosquet [23] of the Drupal Security Team, Xenza [24] and frega [25]. * The Access bypass for content administration was fixed by Jennifer Hodgdon [26]. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [27]. Learn more about the Drupal Security team and their policies [28], writing secure code for Drupal [29], and securing your site [30]. [1] http://drupal.org/project/drupal [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1558412 [4] http://drupal.org/project/drupal [5] http://drupal.org/user/923254 [6] http://drupal.org/user/396253 [7] http://drupal.org/user/9446 [8] http://drupal.org/user/170314 [9] http://drupal.org/user/243377 [10] http://drupal.org/user/414525 [11] http://drupal.org/user/1271628 [12] http://drupal.org/user/1792496 [13] http://drupal.org/user/155601 [14] http://drupal.org/user/9446 [15] http://drupal.org/user/16747 [16] http://drupal.org/user/52142 [17] http://drupal.org/user/102818 [18] http://drupal.org/user/91990 [19] http://drupal.org/user/65776 [20] http://drupal.org/user/9446 [21] http://drupal.org/user/22211 [22] http://drupal.org/user/36762 [23] http://drupal.org/user/52142 [24] http://drupal.org/user/1792496 [25] http://drupal.org/user/243377 [26] http://drupal.org/user/155601 [27] http://drupal.org/contact [28] http://drupal.org/security-team [29] http://drupal.org/writing-secure-code [30] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-072 - cctags - Cross Site Scripting (XSS)
by security-news＠drupal.org 02 May '12

02 May '12

View online: http://drupal.org/node/1558248 * Advisory ID: DRUPAL-SA-CONTRIB-2012-072 * Project: cctags [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-May-02 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create "tag clouds" with taxonomy terms displayed in different sizes depending on how frequently they are used on a site. The module doesn't sufficiently filter user supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit vocabularies or terms. -------- VERSIONS AFFECTED --------------------------------------------------- * cctags 6.x-1.x versions prior to 6.x-1.10. * cctags 7.x-1.x versions prior to 7.x-1.10. Drupal core is not affected. If you do not use the contributed cctags [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the cctags module for Drupal 6.x, upgrade to cctags 6.x-1.10 [4] * If you use the cctags module for Drupal 7.x, upgrade to cctags 7.x-1.10 [5] Also see the cctags [6] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Oleg Kovalchuk [9] the module maintainer * Greg Knaddison [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [11] of the Drupal Security Team * Greg Knaddison [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/cctags [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/cctags [4] http://drupal.org/node/1508098 [5] http://drupal.org/node/1508100 [6] http://drupal.org/project/cctags [7] http://drupal.org/user/102818 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/338442 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/102818 [12] http://drupal.org/user/36762 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-071 - Glossify - Cross Site Scripting (XSS) - Unsupported
by security-news＠drupal.org 02 May '12

02 May '12

View online: http://drupal.org/node/1557874 * Advisory ID: DRUPAL-SA-CONTRIB-2012-071 * Project: Glossify Internal Links Auto SEO [1] (third-party module) * Version: 6.x * Date: 2012-May-02 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module generates internal node to node, node to taxonomy or node to external URL links (crosslinks) automatically - ideal for SEO of your site's pages and partner pages. This module does not protect against an Cross Site Scripting (XSS) attack. The vulnerability is mitigated by the fact that the attacker must be able to create or edit any of: content (nodes), vocabularies, or terms. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-2.5 and before Drupal core is not affected. If you do not use the contributed Glossify Internal Links Auto SEO [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module, it is no longer supported. Also see the Glossify Internal Links Auto SEO [4] project page. -------- REPORTED BY --------------------------------------------------------- * Andrei Turcanu -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [5] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. [1] http://drupal.org/project/glossify [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/glossify [4] http://drupal.org/project/glossify [5] http://drupal.org/user/102818 [6] http://drupal.org/contact [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-070 - Taxonomy Grid : Catalog - Cross Site Scripting (XSS) - Unsupported
by security-news＠drupal.org 02 May '12

02 May '12

View online: http://drupal.org/node/1557872 * Advisory ID: DRUPAL-SA-CONTRIB-2012-070 * Project: Taxonomy Grid : Catalog [1] (third-party module) * Version: 6.x * Date: 2012-May-02 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module provides a page where you can see each content types you've selected under terms from vocabularies you've selected. This module does not properly filter user supplied text resulting in a Cross Site scripting bug. This vulnerability is mitigated by the fact that an attacker would need the ability to create or edit a vocabulary or term. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-1.6 and before Drupal core is not affected. If you do not use the contributed Taxonomy Grid : Catalog [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module Also see the Taxonomy Grid : Catalog [4] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Tack [5] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/taxonomy_grid [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/taxonomy_grid [4] http://drupal.org/project/taxonomy_grid [5] http://drupal.org/user/96647 [6] http://drupal.org/user/102818 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-069 - Addressbook - Multiple vulnerabilities - Unsupported
by security-news＠drupal.org 02 May '12

02 May '12

View online: http://drupal.org/node/1557868 * Advisory ID: DRUPAL-SA-CONTRIB-2012-069 * Project: Addressbook [1] (third-party module) * Version: 6.x * Date: 2012-May-02 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, SQL Injection -------- DESCRIPTION --------------------------------------------------------- This module contains a simple addressbook. The module has multiple issues including SQL Injection and Cross Site Request Forgery. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-4.2 and before Drupal core is not affected. If you do not use the contributed Addressbook [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ This module is not supported. Uninstall the module. Also see the Addressbook [4] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Hess [5] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. [1] http://drupal.org/project/addressbook [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/addressbook [4] http://drupal.org/project/addressbook [5] http://drupal.org/user/102818 [6] http://drupal.org/contact [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-068 - Node Gallery - Cross Site Request Forgery (CSRF) - Unsupported
by security-news＠drupal.org 02 May '12

02 May '12

View online: http://drupal.org/node/1557852 * Advisory ID: DRUPAL-SA-CONTRIB-2012-068 * Project: Node Gallery [1] (third-party module) * Version: 6.x * Date: 2012-May-02 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Node gallery enable users to create a more flexible and powerful gallery that are fully integrated with Drupal's core node system. This module does not protect a CSRF attack when creating node galleries. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-3.1 and before Drupal core is not affected. If you do not use the contributed Node Gallery [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module, this module is no longer supported. Also see the Node Gallery [4] project page. -------- REPORTED BY --------------------------------------------------------- * Andrew Berry [5] -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/node_gallery [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/node_gallery [4] http://drupal.org/project/node_gallery [5] http://drupal.org/user/71291 [6] http://drupal.org/user/102818 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-067 - Linkit - Access bypass
by security-news＠drupal.org 25 Apr '12

25 Apr '12

View online: http://drupal.org/node/1547738 * Advisory ID: DRUPAL-SA-CONTRIB-2012-067 * Project: Linkit [1] (third-party module) * Version: 7.x * Date: 2012-April-25 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Linkitprovides an easy interface for internal and external linking. Linkit links to nodes, users, managed files, terms and have basic support for all entities by default, using an autocomplete field. When searching for entities, no access restrictions were added and users may see information about content that they do not normally have access to see. This issue only affects sites using an entity access module to limit access to content for some users. -------- VERSIONS AFFECTED --------------------------------------------------- * Linkit 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Linkit [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Linkit module for Drupal 7.x, upgrade to Linkit 7.x-2.3 [4] Also see the Linkit [5] project page. -------- REPORTED BY --------------------------------------------------------- * PAULAP [6] -------- FIXED BY ------------------------------------------------------------ * Emil Stjerneman [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/linkit [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/linkit [4] http://drupal.org/node/1547716 [5] http://drupal.org/project/linkit [6] http://drupal.org/user/29978 [7] http://drupal.org/user/464598 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-066 - Spaces and Spaces OG - Access Bypass
by security-news＠drupal.org 25 Apr '12

25 Apr '12

View online: http://drupal.org/node/1547736 * Advisory ID: DRUPAL-SA-CONTRIB-2012-066 * Project: Spaces [1] (third-party module) * Version: 6.x * Date: 2012-April-25 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Spaces is an API module intended to make configuration options generally avaliable only at the sitewide level to be configurable and overridden by individual "spaces" on a Drupal site. The spaces and spaces_og modules (part of the spaces package) in some cases do not apply the expected spaces access permission to pages that are non-objects (e.g. /node) This vulnerability is mitigated by the fact that node_access and user profile permissions will prevent node or user data from being exposed, but other information (e.g. block data,etc) is still displayed. This issue only affects sites using spaces to limit access to content for some users. -------- VERSIONS AFFECTED --------------------------------------------------- * Spaces 6.x-3.x versions prior to 6.x-3.4. Drupal core is not affected. If you do not use the contributed Spaces [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Spaces module for Drupal 6.x, upgrade to Spaces 6.x-3.4 [4] Also see the Spaces [5] project page. -------- REPORTED BY --------------------------------------------------------- * hefox [6] -------- FIXED BY ------------------------------------------------------------ * Patrick Settle [7] the module maintainer * Fox [8] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team * Matt Kleve [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/spaces [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/spaces [4] http://drupal.org/node/1547730 [5] http://drupal.org/project/spaces [6] http://drupal.org/user/426416 [7] http://drupal.org/user/26618 [8] http://drupal.org/user/426416 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/102818 [11] http://drupal.org/user/150473 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-063 - RealName - Cross Site Scripting (XSS)
by security-news＠drupal.org 25 Apr '12

25 Apr '12

View online: http://drupal.org/node/1547660 * Advisory ID: DRUPAL-SA-CONTRIB-2012-063 * Project: RealName [1] (third-party module) * Version: 6.x * Date: 2012-April-25 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module allows you to set a pattern for constructing "Real names" for users out of profile fields. The module does not sufficiently escape users' real names under certain circumstances which could lead to a Cross-Site Scripting (XSS) [3] attack. -------- VERSIONS AFFECTED --------------------------------------------------- * RealName 6.x-1.x versions prior to 6.x-1.5 [4]. * RealName 7.x-1.x versions are not vulnerable. Drupal core is not affected. If you do not use the contributed RealName [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the RealName module for Drupal 6.x, upgrade to RealName 6.x-1.5 [6]. Also see the RealName [7] project page. -------- REPORTED BY --------------------------------------------------------- * Gabor Szanto [8] * Dave Reid [9], module maintainer and Drupal Security Team member -------- FIXED BY ------------------------------------------------------------ * Gabor Szanto [10] * Dave Reid [11], module maintainer and Drupal Security Team member -------- COORDINATED BY ------------------------------------------------------ * Dave Reid [12] of the Drupal Security Team * Michael Hess [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. [1] http://drupal.org/project/realname [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/node/1547352 [5] http://drupal.org/project/realname [6] http://drupal.org/node/1547352 [7] http://drupal.org/project/realname [8] http://drupal.org/user/610310 [9] http://drupal.org/user/53892 [10] http://drupal.org/user/610310 [11] http://drupal.org/user/53892 [12] http://drupal.org/user/53892 [13] http://drupal.org/user/102818 [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration

1 1